---
cve: "CVE-2026-78847"
severity: "CRITICAL"
cvss: 9.8
epss: "0.6%"
vendor: "n/a"
kev: false
exploited: false
published: "2026-09-21 22:16:58"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-20T13:48:39+02:00"
---

# CVE-2026-78847

> 9.8 CRITICAL · 🧪 PoC

## Beschreibung

An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code execution.

## CNA-Record (Kanon, cvelistV5)

- CNA: **mitre**
- State: PUBLISHED
- Stand: 2026-09-22 15:12:53

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-95** — Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
  The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

## Angriffsmuster (CAPEC)

- [CAPEC-35 — Leverage Executable Code in Non-Executable Files](https://capec.mitre.org/data/definitions/35.html) _(Severity: Very High)_

## ATT&CK-Techniken

- [T1027.006 — Obfuscated Files or Information: HTML Smuggling](https://attack.mitre.org/techniques/T1027/006/)
- [T1027.009 — Obfuscated Files or Information: Embedded Payloads](https://attack.mitre.org/techniques/T1027/009/)
- [T1564.009 — Hide Artifacts: Resource Forking](https://attack.mitre.org/techniques/T1564/009/)

## Referenzen

- <https://github.com/jonschlinkert/gray-matter/issues/182>
- <https://github.com/jonschlinkert/gray-matter/issues/131>
- <https://github.com/jonschlinkert/gray-matter/issues/112>
- <https://blog.checo.cc/en/posts/Security/1>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-78847/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_